[MDEV-22509] Server crashes in Field_inet6::store_inet6_null_with_warn / Field::maybe_null Created: 2020-05-08  Updated: 2023-04-06  Resolved: 2020-06-02

Status: Closed
Project: MariaDB Server
Component/s: Data types, Optimizer
Affects Version/s: 10.5
Fix Version/s: 10.5.4

Type: Bug Priority: Major
Reporter: Elena Stepanova Assignee: Varun Gupta (Inactive)
Resolution: Fixed Votes: 0
Labels: None

Issue Links:
Relates
relates to MDEV-22583 Selectivity for BIT columns in filter... Closed
relates to MDEV-274 The data type for IPv6/IPv4 addresses... Closed
relates to MDEV-31016 Server crashes in Field::maybe_null /... Open

 Description   

CREATE TABLE t1 (a INT, b INET6 NOT NULL);
INSERT INTO t1 VALUES (1,'::'),(2,'::');
ANALYZE TABLE t1 PERSISTENT FOR ALL;
UPDATE t1 SET a = 0;
 
# Cleanup
DROP TABLE t1;

10.5 ba573c47

#3  <signal handler called>
#4  0x000056117ff34a35 in Field::maybe_null (this=0x7f6aa006a5f8) at /data/src/10.5/sql/field.h:1347
#5  0x0000561180bd111c in Field_inet6::store_inet6_null_with_warn (this=0x7f6aa006a5f8, inet6=..., err=...) at /data/src/10.5/plugin/type_inet/sql_type_inet.cc:640
#6  0x0000561180bd1ce0 in Field_inet6::store_binary (this=0x7f6aa006a5f8, str=0x7f6aa0041b35 "::", length=2) at /data/src/10.5/plugin/type_inet/sql_type_inet.cc:783
#7  0x0000561180bd1b38 in Field_inet6::store (this=0x7f6aa006a5f8, str=0x7f6aa0041b35 "::", length=2, cs=0x56118184a040 <my_charset_bin>) at /data/src/10.5/plugin/type_inet/sql_type_inet.cc:769
#8  0x000056117ff78825 in Column_stat::get_stat_values (this=0x7f6ab00eb190) at /data/src/10.5/sql/sql_statistics.cc:1140
#9  0x000056117ff7336a in read_statistics_for_table (thd=0x7f6aa0000b18, table=0x7f6aa00099a8, stat_tables=0x7f6ab00eb3a0) at /data/src/10.5/sql/sql_statistics.cc:3009
#10 0x000056117ff743ba in read_statistics_for_tables (thd=0x7f6aa0000b18, tables=0x7f6aa0013a28) at /data/src/10.5/sql/sql_statistics.cc:3349
#11 0x000056117ff73f38 in read_statistics_for_tables_if_needed (thd=0x7f6aa0000b18, tables=0x7f6aa0013a28) at /data/src/10.5/sql/sql_statistics.cc:3283
#12 0x000056117ffbbecd in mysql_update (thd=0x7f6aa0000b18, table_list=0x7f6aa0013a28, fields=..., values=..., conds=0x0, order_num=0, order=0x0, limit=18446744073709551615, ignore=false, found_return=0x7f6ab00ecf80, updated_return=0x7f6ab00ed050) at /data/src/10.5/sql/sql_update.cc:428
#13 0x000056117fe9d304 in mysql_execute_command (thd=0x7f6aa0000b18) at /data/src/10.5/sql/sql_parse.cc:4370
#14 0x000056117fea959c in mysql_parse (thd=0x7f6aa0000b18, rawbuf=0x7f6aa0013950 "UPDATE t1 SET a = 0", length=19, parser_state=0x7f6ab00ed520, is_com_multi=false, is_next_command=false) at /data/src/10.5/sql/sql_parse.cc:7957
#15 0x000056117fe958a4 in dispatch_command (command=COM_QUERY, thd=0x7f6aa0000b18, packet=0x7f6aa01b0409 "UPDATE t1 SET a = 0", packet_length=19, is_com_multi=false, is_next_command=false) at /data/src/10.5/sql/sql_parse.cc:1840
#16 0x000056117fe94036 in do_command (thd=0x7f6aa0000b18) at /data/src/10.5/sql/sql_parse.cc:1359
#17 0x0000561180037669 in do_handle_one_connection (connect=0x5611843919f8, put_in_cache=true) at /data/src/10.5/sql/sql_connect.cc:1411
#18 0x00005611800373d1 in handle_one_connection (arg=0x5611843919f8) at /data/src/10.5/sql/sql_connect.cc:1313
#19 0x000056118056ccea in pfs_spawn_thread (arg=0x56118431d408) at /data/src/10.5/storage/perfschema/pfs.cc:2201
#20 0x00007f6ab74d84a4 in start_thread (arg=0x7f6ab00ee700) at pthread_create.c:456
#21 0x00007f6ab560cd0f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:97

Reproducible with at least InnoDB, MyISAM, Aria, on debug and non-debug builds alike.
Server doesn't crash if INET6 is replaced with e.g. CHAR(39).



 Comments   
Comment by Varun Gupta (Inactive) [ 2020-05-18 ]

Patch
https://github.com/MariaDB/server/commit/c98d86d128a4d2df07624d40b280bc6770549ed7

Comment by Alexander Barkov [ 2020-05-18 ]

The patch
https://github.com/MariaDB/server/commit/c98d86d128a4d2df07624d40b280bc6770549ed7
looks fine for me. Thanks.

Your patch seems to be fixing MDEV-22583 at once. Please make sure to add tests for MDEV-22583 (or merge them from 10.1).

Generated at Thu Feb 08 09:15:15 UTC 2024 using Jira 8.20.16#820016-sha1:9d11dbea5f4be3d4cc21f03a88dd11d8c8687422.